Airplane systems are driven to high reliability because of the consequence of failure while flying. The standard reliability required is less than one chance of failure in 109 hours in any flight critical function. Current airplanes use multiple redundant electrical systems and multiple redundant hydraulic systems to power many types of systems. For the most critical applications, hydraulic actuators are commonly used today because of their ability to operate in parallel and their low probability of jamming. There is a desire to reduce and/or eliminate the hydraulic systems due to the maintenance and weight of these systems.
Electro-mechanical actuators designed for critical flight functions are made up of mechanical and electrical components. Almost all mechanical and electrical components do not have reliability in excess of 10−9 hours. This means all components of these actuator systems must have redundancy. Specifically, if there is a single gearbox or screw that can jam, this prevents the system from meeting this reliability approach. Different approaches including clutches, brakes, breakaway features, and series actuation have been suggested to meet this challenge, but to date have not been able to meet the size, cost, and weight requirements.
There are many patents and applications that are on high reliability electro-mechanical actuation. Concepts typically fall into one of 4 categories: 1) parallel actuators with each actuator having a frangible element in the case of a jam, 2) parallel actuators with each actuator having a clutch function that can be released upon a jam and reconnected after jam is cleared, 3) two concentric screws each with its own brake, or 4) two actuators in series to reduce the single point jam failure.
Designs in this first category that have frangible elements in them are typically the oldest. These designs all require enough overload capability in the parallel actuator to break a linkage or other mechanical element (e.g., U.S. Pat. No. 5,518,466.) They have the significant disadvantage that there is difficulty in assuring proper function because testing is destructive by definition. Further the mechanical design constraint of this overload force is a significant disadvantage in the system design and ultimately results in a larger package. In all of these designs, the linkage most not fail to break with a probability of greater than 1 in 105 and this is a challenge to certify at best.
Designs in the second category employ a clutch type mechanism which addresses the weakness of destructive testing seen in the first category (e.g., U.S. Pat. No. 4,179,944 and U.S. Pat. No. 8,336,818.) This retains the challenge of certifying that the clutch mechanism must work with a probability greater than 1 in 105. Further, this typically requires a detection of the failure and a separate action to disengage the clutch. This is not ideal because it disrupts the operation of the aircraft until this is done.
Designs in the third category employ two concentric screws with a brake between the two that is opened if the outer screw fails (e.g., U.S. Pat. No. 4,745,815). At the same time a brake between the outer screw and housing is activated. This has the challenge of achieving the reliability with two extra brakes in the system, which is even more severe than the clutch reliability issue for the second category.
Designs in the fourth category have two actuators in series that can each function if one of the actuators jams. Many of these patents, however, describe a system that still has a single point failure in a gear or other mechanism that cannot achieve the 10−9 reliability. It should be noted for comparison that in a hydraulic actuator used in parallel, a jam between the cylinder and the piston will cause a system failure. This means that this joint must have a reliability greater than 10−9. Unfortunately, very few mechanical joints are this simple, and it would be difficult to certify any linear mechanical joint other than a telescoping rod/piston joint for an incidence of jamming less than 10−9. In a hydraulic rotary actuator, there is an equivalent rotary seal that also must be able to achieve this 10−9 reliability. Since bearings do not meet this 10−9 reliability, rotary actuators may use concentric bearings to achieve this reliability.
One thing all fourth category designs have in common is the use of two motors, one for each of the two series actuators. Some of these actuators attempt to achieve the reliability without a parallel actuator by employing brakes on each of the motors should they fail. These have the inherent weakness that the connection point to the movable surface can still fail as a single point failure so this is not likely to be certifiable. This means that this category should be viewed as an approach to have a minimum of two actuators in series with a minimum of two actuators in parallel using at least four motors. There are different approaches shown i) where the two motors are concentric with each other (e.g. U.S. Pat. No. 4,614,128, US 2010/0203974), ii) the two screws are concentric with each other (e.g. U.S. Pat. No. 7,883,054, US 2005/0168084 US 2010/0012779), iii) two ball screws are on the same ball screw nut (e.g. U.S. Pat. No. 5,214,972). Each of these concepts conceptually addresses the single point jam condition, but many of these concepts do not show the detail of sensors and control necessary for the application or do not implement these concepts in a way that truly addresses the single point jam condition. Further, each of these configurations shown in these patents is a large unit that must have significant size and weight. Ultimately, if electro-mechanical actuation is going to be desirable over the incumbent solution it must be a simple, compact, and lightweight approach that does not exist in the literature.